'Safari cookie based SSO
Right now I'm trying to implement the SSO (single sign-on) feature for my applications. I have the common-auth domain and a couple of apps (domain AAA and domain BBB). The common-auth domain verifies user and response with the JWT token in cookies.
While I'm in domain AAA I sign in with the common-auth domain and got an access token (JWT) as a cookie. Then I continue interactions with the AAA domain. After that, I open the domain BBB in a new tab. The application automatically makes a query to the common-auth server. I expect that the access token cookie, which I got from AAA, will be added to the query. But it's not.
I can't fully understand why it's not working. Everything is fine in Chrome, IE, and Firefox. Obviously, there are some restrictions with cookies in Safari. How can I bypass that problem? What parameters should I add to the cookie to handle cookie sharing?
Read about cookie partitioning and Safari ITP. Is it possible to implement this scheme if I add UI interface for auth, and store its cookies with Storage access API? How could I use auth cookies from AAA or BBB?
PS. I won't use cookies for tracking or for some advertisements, only for improving user experience.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|